Safe Omada MCP

Security-focused MCP server for TP-Link Omada Open API workflows.

At a Glance

• Production-safe baseline uses stdio
• Omada credentials are environment-only
• Capability profiles and category gating control what tools are exposed
• HTTP remains in the codebase only as an explicitly unsafe, lab-only path
• Validated against live Omada Controller 6.x environments and designed around the documented 5.x/6.x Open API surface

Quick Start

Option 1: Use with Claude Desktop via Docker

1. Pull or build an image:

   docker pull ghcr.io/gaspareduard/omada-mcp:latest

   If you do not publish an image yet, build locally instead:

   npm run docker:build

2. Edit your Claude Desktop MCP config:

   • macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
   • Windows: %APPDATA%\Claude\claude_desktop_config.json

3. Add the server entry:

   {
     "mcpServers": {
       "safe-omada": {
         "command": "docker",
         "args": [
           "run",
           "-i",
           "--rm",
           "-e", "OMADA_BASE_URL=https://your-omada-controller.local",
           "-e", "OMADA_CLIENT_ID=your-client-id",
           "-e", "OMADA_CLIENT_SECRET=your-client-secret",
           "-e", "OMADA_OMADAC_ID=your-omadac-id",
           "-e", "OMADA_SITE_ID=your-site-id",
           "-e", "OMADA_STRICT_SSL=true",
           "ghcr.io/gaspareduard/omada-mcp:latest"
         ]
       }
     }
   }

4. Restart Claude Desktop and verify the server by listing sites or devices.

Option 2: Run the container directly

docker run --rm -it \
  --env-file .env \
  ghcr.io/gaspareduard/omada-mcp:latest

Option 3: Run locally for development

npm install
npm run build
npm start

Configuration

The server reads configuration from environment variables. See .env.example for the complete reference.

Required Omada Variables

| Variable | Required | Default | Description | | --- | --- | --- | --- | | OMADA_BASE_URL | Yes | - | Base URL of the Omada controller | | OMADA_CLIENT_ID | Yes | - | OAuth client ID from Omada Platform Integration | | OMADA_CLIENT_SECRET | Yes | - | OAuth client secret | | OMADA_OMADAC_ID | Yes | - | Omada controller ID (omadacId) | | OMADA_SITE_ID | No | - | Optional default site ID | | OMADA_STRICT_SSL | No | true | Enforce TLS certificate validation | | OMADA_TIMEOUT | No | 30000 | HTTP timeout in milliseconds |

Capability and Logging

| Variable | Required | Default | Description | | --- | --- | --- | --- | | OMADA_CAPABILITY_PROFILE | No | safe-read | Built-in profile: safe-read, ops-write, admin, compatibility | | OMADA_TOOL_CATEGORIES | No | profile default | Explicit category override | | MCP_SERVER_LOG_LEVEL | No | info | debug, info, warn, error, silent | | MCP_SERVER_LOG_FORMAT | No | plain | plain, json, or gcp-json |

Capability Profiles

| Profile | Intended use | | --- | --- | | safe-read | Default read-only operational visibility | | ops-write | Limited operational write actions | | admin | Full documented tool surface, including admin mutations | | compatibility | Reserved for future controller-specific fallback modules |

Destructive Tool Confirmation Gate

The four restore tools (restoreController, restoreControllerFromFileServer, restoreSites, restoreSitesFromFileServer) enforce a two-step confirmation: without confirmDangerous: true the tool returns a warning explaining the action is irreversible and that a force recovery or factory reset may be required if something goes wrong.

Scope of this protection: this gate is effective in conversational AI sessions where the warning is surfaced to a human who then decides whether to confirm. It does not prevent a fully autonomous agent from passing confirmDangerous: true programmatically without human review.

True human-in-the-loop enforcement requires one or both of:

• MCP client approval mode — Claude Desktop and compatible MCP hosts can be configured to require explicit human approval before any tool call executes. This is the only reliable technical gate against autonomous execution.
• Capability profile restriction — the restore tools require maintenance:rw, which is only granted under ops-write or admin. Keeping the deployment on the default safe-read profile blocks all restore tools entirely.

Optional HTTP Lab Mode

HTTP is not part of the supported production baseline.

It only starts when both of these are set:

• MCP_SERVER_USE_HTTP=true
• MCP_UNSAFE_ENABLE_HTTP=true

Use it only for local lab/debug scenarios.

| Variable | Required | Default | Description | | --- | --- | --- | --- | | MCP_SERVER_USE_HTTP | No | false | Legacy lab-only switch | | MCP_UNSAFE_ENABLE_HTTP | No | false | Explicit acknowledgement required | | MCP_HTTP_PORT | No | 3000 | HTTP port | | MCP_HTTP_BIND_ADDR | No | 127.0.0.1 | Loopback bind address only (127.0.0.1 or ::1) | | MCP_HTTP_PATH | No | /mcp | MCP endpoint path | | MCP_HTTP_ENABLE_HEALTHCHECK | No | true | Enable health check | | MCP_HTTP_HEALTHCHECK_PATH | No | /healthz | Health check path | | MCP_HTTP_ALLOW_CORS | No | true | Enable CORS | | MCP_HTTP_ALLOWED_ORIGINS | No | 127.0.0.1, localhost | Allowed origins | | MCP_HTTP_NGROK_ENABLED | No | false | Legacy placeholder; disabled in safe baseline | | MCP_HTTP_NGROK_AUTH_TOKEN | No | - | Legacy placeholder |

Development and Validation

Common Commands

| Task | Command | | --- | --- | | Run dev server | npm run dev | | Build | npm run build | | Lint + type-check | npm run check | | Unit tests | npm test | | Coverage gates | npm run test:coverage | | Symlink integrity | npm run symlinks:check | | README/tool sync | node scripts/check-readme-sync.mjs | | Tool/test mapping | node scripts/check-tool-tests.mjs |

Inspector

Use the MCP Inspector when you want to test the built server interactively:

npm run inspector
npm run inspector:build

Project Notes

• The safe baseline is stdio first.
• HTTP remains a legacy, explicitly unsafe lab path.
• The repo includes docs/openapi/ as the implementation reference for Omada endpoints.
• README tool tables below are kept in sync with the registered MCP tools.

Tools

Site & Client

| Tool | Description | | --------------------------- | ---------------------------------------------------------------------------- | | listSites | Lists all sites configured on the controller. | | getSiteCapacity | Get site capacity settings including maximum device and client counts. | | getSiteDetail | Get detailed information about a site, including name, region, timezone, and configuration. | | getSiteDeviceAccount | Get device account settings for a site. | | getSiteNtpStatus | Get NTP server status and configuration for a site. | | getSiteRememberSetting | Get the remember device setting for a site. | | getSiteSpecification | Get site specification including device limits and feature capabilities. | | getSiteUrl | Get the URL associated with a site for OpenAPI access. | | getSiteTemplateConfig | Get configuration settings for a site template. Requires siteTemplateId. | | getSiteTemplateDetail | Get detailed information about a site template. Requires siteTemplateId. | | getSiteTemplateList | List all site templates configured on the controller. | | listClients | Lists active client devices for a site. | | getClient | [DEPRECATED] Use listClients instead. When you have a client MAC, getClientDetail is also available. This tool filters the site client list in-process. | | listMostActiveClients | Gets the most active clients sorted by traffic usage. | | listClientsActivity | Gets client activity statistics over time. | | listClientsPastConnections| Gets past connection history for clients. | | setClientRateLimit | Sets custom bandwidth limits (download/upload) for a specific client. | | setClientRateLimitProfile | Applies a predefined rate limit profile to a specific client. | | disableClientRateLimit | Disables bandwidth rate limiting for a specific client. | | blockClient | Blocks a client from network access with an auditable mutation summary. | | unblockClient | Restores a blocked client to network access with an auditable mutation summary. | | reconnectClient | Forces a client to reconnect with an auditable mutation summary. | | rebootDevice | Reboots a managed device with an auditable mutation summary. | | setDeviceLed | Changes a device LED state with an auditable mutation summary. |

Device

| Tool | Description | | ----------------------- | --------------------------------------------------------------------------------- | | listDevices | Lists provisioned devices for a given site. | | getDevice | [DEPRECATED] Use listDevices instead and filter results client-side. This tool filters the site device list in-process; there is no dedicated device-detail endpoint. | | searchDevices | Searches for devices globally across all sites the user has access to. | | listDevicesStats | Queries statistics for global adopted devices with pagination and filtering. | | getSwitchStackDetail | Retrieves detailed configuration and status for a switch stack. | | getSwitchDetail | Fetches detailed configuration and status for a specific switch. | | getGatewayDetail | Fetches detailed configuration and status for a specific gateway. | | getGatewayWanStatus | Gets WAN port status for a specific gateway. | | getGatewayLanStatus | Gets LAN port status for a specific gateway. | | getGatewayPorts | Gets port information for a specific gateway. | | getApDetail | Fetches detailed configuration and status for a specific access point. | | getApRadios | Gets radio information for a specific access point. | | getStackPorts | Gets port information for a switch stack. | | listPendingDevices | Lists devices pending adoption in a site. | | getAllDeviceBySite | Gets all devices in a site including offline and disconnected devices. | | getFirmwareInfo | Gets the latest available firmware info for a device. Use listDevices for MACs. | | getGridAutoCheckUpgrade | Gets the auto-check firmware upgrade plan list (paginated). | | listSwitchNetworks | Lists VLAN network assignments for a switch (paginated). Requires switchMac. | | getSwitchGeneralConfig | Gets general configuration for a switch. Requires switchMac. | | getCableTestLogs | Gets cable test history for a switch. Requires switchMac. | | getCableTestFullResults | Gets full per-port cable diagnostics for a switch. Requires switchMac. | | getOswStackLagList | Gets Link Aggregation Group (LAG) list for a switch stack. Requires stackId. | | getStackNetworkList | Gets VLAN network list for a switch stack (paginated). Requires stackId. | | getApUplinkConfig | Gets uplink configuration for an AP (wired/mesh mode). Requires apMac. | | getRadiosConfig | Gets per-radio configuration for an AP (channel, power, width). Requires apMac. | | getApVlanConfig | Get VLAN configuration for an access point, including management VLAN and per-SSID VLAN tagging settings. | | getMeshStatistics | Gets mesh link statistics for an AP. Requires apMac. | | getRFScanResult | Gets last RF scan results for an AP. Requires apMac. | | getSpeedTestResults | Gets last speed test results for an AP. Requires apMac. | | getApSnmpConfig | Gets SNMP configuration for an AP. Requires apMac. | | getApLldpConfig | Gets LLDP configuration for an AP. Requires apMac. | | getApGeneralConfig | Gets general configuration for an AP (name, LED, country). Requires apMac. | | getUplinkWiredDetail | Get wired uplink detail for an access point: uplink switch, port number, link speed, and PoE status. | | getDownlinkWiredDevices | Gets wired downlink devices on an AP's LAN ports. Requires apMac. | | getFirmwareUpgradePlan | Get the firmware upgrade plan list for devices managed by the controller. | | getUpgradeLogs | Get firmware upgrade logs showing the history of upgrade operations performed on devices. | | getDeviceTagList | Get the list of device tags defined in a site. | | getApQosConfig | Get QoS configuration for a specific access point. Requires apMac. | | getApIpv6Config | Get IPv6 configuration for a specific access point. Requires apMac. | | getSitesApsIpSetting | Get IP settings for an AP. Requires apMac. | | getSitesApsChannelLimit | Get channel limit configuration for an AP. Requires apMac. | | getSitesApsAvailableChannel | Get list of available channels for an AP. Requires apMac. | | getSitesApsLoadBalance | Get load balance configuration for an AP. Requires apMac. | | getSitesApsOfdma | Get OFDMA configuration for an AP. Requires apMac. | | getSitesApsPowerSaving | Get power saving configuration for an AP. Requires apMac. | | setApPowerSaving | Updates AP power saving configuration with support checks and dry-run preview. Requires apMac. | | setApChannelLimit | Updates AP channel-limit configuration with support checks and dry-run preview. Requires apMac. | | setApConfig | Updates documented AP configuration families with dry-run preview. Covers AP general, IP, IPv6, QoS, radio, service, load-balance, OFDMA, trunk, bridge, WLAN group, port, channel, AFC, and antenna settings. Setter-only families return planned payloads and an explicit warning when controller readback is unavailable. Requires apMac. | | getSitesApsTrunkSetting | Get trunk port setting for an AP. Requires apMac. | | getSitesApsBridge | Get bridge configuration for an AP. Requires apMac. | | listSitesApsPorts | List ports for an AP. Requires apMac. | | getSitesSwitchesEs | Get ES switch details. Requires switchMac. | | getSitesSwitchesEsGeneralConfig | Get ES switch general configuration. Requires switchMac. | | listSitesCableTestSwitchesPorts | List cable test port info for a switch. Requires switchMac. | | listSitesCableTestSwitchesIncrementResults | Get incremental cable test results for a switch. Requires switchMac. | | getUpgradeOverviewCritical | Get the number of critical models available for upgrade. | | getUpgradeOverviewTryBeta | Get the current status of the try-beta firmware upgrade switch. | | listUpgradeFirmwares | List available firmware packages for upgrade (paginated). | | listUpgradeOverviewFirmwares | List firmware overview for upgradeable devices (paginated). | | listSitesStacks | List switch stacks in a site (paginated). | | getSitesDeviceWhiteList | Get the device adoption whitelist for a site (paginated). | | getSitesGatewaysGeneralConfig | Get general configuration for a gateway. Requires gatewayMac. | | getSitesGatewaysPin | Get PIN information for a gateway. Requires gatewayMac. | | getSitesGatewaysSimCardUsed | Get SIM card usage info for a gateway. Requires gatewayMac. | | getSitesHealthGatewaysWansDetails | Get gateway WAN health details. Requires gatewayMac. | | setGatewayConfig | Updates documented gateway configuration families with dry-run preview. Covers general, services, advanced, radios, WLAN, and port settings. Setter-only families return planned payloads and an explicit warning when controller readback is unavailable. Requires gatewayMac. |

Network

| Tool | Description | | ----------------------------- | --------------------------------------------------------------------------- | | getInternetInfo | Gets internet configuration information for a site. | | getInternet | [DEPRECATED] Use getInternetInfo instead. Gets full WAN/Internet configuration for the site gateway. | | getInternetBasicPortInfo | Gets WAN port summary/basic info for the site gateway. | | getInternetLoadBalance | Gets WAN load balancing configuration (failover/load balance). | | getWanPortsConfig | Gets per-port WAN configuration including connection type and IP settings. | | getWanLanStatus | Gets WAN-LAN connectivity status for a site. | | getGridVirtualWan | Gets virtual WAN list (paginated). | | getIspBandScan | Gets ISP band scan results for a WAN port. Requires portUuid. | | getDisableNatList | Gets the list of wired networks with NAT disabled (paginated). | | getLtePortConfig | Gets LTE/cellular WAN port configuration. | | getWanPortDetail | [DEPRECATED] Use getWanPortsConfig instead. Gets detailed WAN port configuration for all gateway WAN ports. | | getWanIspProfile | Gets ISP scan profile result for a WAN port. Requires portUuid. | | getWanQosConfig | Gets QoS configuration for gateway WAN ports. | | getWanHealthDetail | [DEPRECATED] Alias for the WAN health tool; kept for backward compatibility. Requires gatewayMac. | | getWanUsageStats | [DEPRECATED] Use getDashboardTrafficActivities instead. Gets WAN traffic usage statistics for the site. | | getWanNatConfig | Gets one-to-one NAT rules (paginated). | | getPortForwardingStatus | Gets port forwarding status and rules. Required: type (user or upnp). Optional pagination: page (default 1), pageSize (default 10). | | getLanNetworkList | [DEPRECATED] Use getLanNetworkListV2 instead. This tool aggregates all pages; getLanNetworkListV2 is explicitly paginated. | | getLanNetworkListV2 | Get the LAN network list using the v2 API, with richer VLAN and DHCP data (paginated). | | getInterfaceLanNetwork | Gets interface-level LAN network bindings. Optional type filter (0=WAN, 1=LAN). | | getInterfaceLanNetworkV2 | Get interface-level LAN network bindings (v2 API). Returns richer per-interface VLAN and network data. | | getLanProfileList | Gets the list of LAN profiles configured in a site. | | getApLoadBalance | [DEPRECATED] Use getSitesApsLoadBalance instead. Same endpoint, retained for backward compatibility. getSitesApsLoadBalance is the canonical tool name. | | getApOfdmaConfig | [DEPRECATED] Use getSitesApsOfdma instead. Same endpoint, retained for backward compatibility. getSitesApsOfdma is the canonical tool name. | | getMulticastRateLimit | Get multicast rate limit settings for a site. | | getWlanGroupList | Gets the list of WLAN groups configured in a site. | | getSsidList | Gets the list of SSIDs in a WLAN group. | | getSsidDetail | Gets detailed information for a specific SSID. Required: wlanId and ssidId. | | listAllSsids | Lists wireless SSIDs across all WLAN groups. | | getFirewallSetting | Gets the site-global firewall settings returned by the official Omada firewall endpoint. | | setFirewallSetting | Updates site firewall settings with dry-run preview using the official Omada Open API firewall endpoint. | | setAclConfigTypeSetting | Updates the gateway ACL mode (through profiles or custom) with dry-run preview. | | getVpnSettings | Gets VPN settings for a site. | | listSiteToSiteVpns | Lists site-to-site VPN configurations. | | listPortForwardingRules | [DEPRECATED] Use getPortForwardingList instead. Lists NAT port forwarding rules. | | listOsgAcls | Lists gateway (OSG) ACL rules. | | createGatewayAcl | Creates a gateway ACL rule with dry-run preview using the official Omada Gateway ACL schema. | | updateGatewayAcl | Updates a gateway ACL rule with dry-run preview after confirming the ACL exists. | | listEapAcls | Lists access point (EAP) ACL rules. | | createEapAcl | Creates an EAP ACL rule with dry-run preview using the official Omada EAP ACL schema. | | updateEapAcl | Updates an EAP ACL rule with dry-run preview after confirming the ACL exists. | | deleteAcl | Deletes an ACL rule with dry-run preview after confirming the ACL exists. | | listStaticRoutes | [DEPRECATED] Use getGridStaticRouting instead. This tool aggregates all pages; getGridStaticRouting returns a single paginated page. | | getStaticRoutingInterfaceList | Gets available interfaces for static routing. | | listPolicyRoutes | [DEPRECATED] Use getGridPolicyRouting instead. This tool aggregates all pages; getGridPolicyRouting is paginated. | | getGridPolicyRouting | Gets policy routing rules (paginated). | | getOspfProcess | Gets OSPF process configuration for the site gateway. | | getOspfInterface | Gets OSPF interface configuration for the site gateway. | | getVrrpConfig | Gets VRRP configuration for OSW devices. | | getOspfNeighbors | Gets OSPF neighbor devices for the site gateway. | | getGridOtoNats | Gets 1:1 NAT rules (paginated). | | getAlg | Gets ALG (Application Layer Gateway) configuration. | | getUpnpSetting | Gets UPnP setting for the site gateway. | | getDdnsGrid | Gets DDNS entries (paginated). | | getDhcpReservationGrid | Gets DHCP reservations (paginated). | | createDhcpReservation | Creates a DHCP reservation after validating the target LAN and optional IP address. | | updateDhcpReservation | Updates a DHCP reservation after validating the target LAN and optional IP address. | | deleteDhcpReservation | Deletes a DHCP reservation by MAC address with a dry-run preview option. | | getGridIpMacBinding | Gets IP-MAC binding entries (paginated). | | getIpMacBindingGeneralSetting | Gets IP-MAC binding global toggle setting. | | getBandwidthControl | Gets global bandwidth control configuration. | | getGridBandwidthCtrlRule | Gets bandwidth control rules (paginated). | | setBandwidthControlRule | Creates or updates a bandwidth control rule with dry-run preview after validating the target rule id plus referenced LAN and WAN identifiers. | | deleteBandwidthControlRule | Deletes a bandwidth control rule with dry-run preview after confirming the rule exists. | | getSessionLimit | Gets session limit global setting. | | getGridSessionLimitRule | Gets per-rule session limit rules (paginated). | | getSnmpSetting | Gets SNMP configuration (version, community string). | | getLldpSetting | Gets LLDP global setting. | | getRemoteLoggingSetting | Gets remote logging (syslog) configuration. | | getDnsCacheDataList | Gets the DNS cache data list (paginated). | | getIptvSetting | Gets IPTV service configuration for the site. | | getNtpSetting | Gets NTP server configuration and synchronisation status. | | getSyslogConfig | Deprecated; alias of getRemoteLoggingSetting for controller syslog configuration. | | getAccessControl | Gets controller access control configuration. | | setAccessControl | Updates portal access control settings with dry-run preview and schema validation for pre-auth and free-auth policy entries. | | setAppControlRule | Creates or updates an application control rule with dry-run preview after validating the create/update payload shape, existing rule id, and referenced application ids. | | deleteAppControlRule | Deletes an application control rule with dry-run preview after confirming the rule exists. | | getDnsCacheSetting | Gets DNS cache setting. | | getDnsProxy | Gets DNS proxy configuration. | | getIgmp | Gets IGMP snooping and proxy setting. | | getSwitchVlanInterface | Gets VLAN interface configuration for a specific switch. Requires switchMac. | | getLanDnsRules | Gets LAN DNS rules for the site (paginated). | | getLanProfileEsUsage | Gets EAP/switch device usage for a LAN profile. Requires profileId. | | getLanClientCount | Gets client distribution breakdown across LAN segments. | | listRadiusProfiles | Lists RADIUS authentication profiles. | | listGroupProfiles | Lists group profiles (IP, MAC, or port groups). | | getApplicationControlStatus | Gets application control status for a site. | | getSshSetting | Gets SSH settings for a site. | | listTimeRangeProfiles | Lists time range profiles. | | getRateLimitProfiles | Gets the list of available rate limit profiles for bandwidth control. |

Firewall & ACL

| Tool | Description | | ----------------------------- | ---------------------------------------------------------------------------------------- | | getDot1xConfig | Get 802.1X switch port authentication setting. Alias for getSwitchDot1xSetting. | | getRadiusProxyConfig | Get global RADIUS proxy configuration (controller-level, no siteId). | | getApplicationAcl | [DEPRECATED] Get application control rules. Alias for getAppControlRules. |

Firewall Traffic & QoS

| Tool | Description | | ----------------------------- | ---------------------------------------------------------------------------------------- | | getGatewayQosClassRules | Get gateway QoS class rules (paginated). | | getBandwidthCtrlDetail | Get bandwidth control details for a site. | | getAppControlRules | Get application control rules (paginated). | | getAppControlCategories | Get application control category list. | | getUrlFilterRules | Get URL filter gateway rules. Alias for getGridGatewayRule. | | getUrlFilterBlacklist | Get URL filter MAC deny list. Alias for getGridDenyMacFiltering. | | getUrlFilterWhitelist | Get URL filter MAC allow list. Alias for getGridAllowMacFiltering. | | getMacFilterDetail | Get MAC filter general setting. Alias for getMacFilteringGeneralSetting. | | getQosPolicy | Get QoS policy configuration for a site. | | getTrafficPriority | Get traffic priority rules for a site. | | getTrafficStats | [DEPRECATED] Use getDashboardTrafficActivities instead. Get WAN usage statistics. Alias for getWanUsageStats. | | getQosPolicyRule | [DEPRECATED] Alias for getQosPolicy. | | getQosMarkingRule | [DEPRECATED] Alias for getQosPolicy. | | getDscpConfig | [DEPRECATED] Alias for getQosPolicy. |

Firewall IDS / IPS

| Tool | Description | | ----------------------------- | ---------------------------------------------------------------------------------------- | | getGlobalSecuritySetting | [DEPRECATED] Use getThreatList instead. Get global security/threat management list. Alias for getThreatList. |

Security & Threat Management

| Tool | Description | | ----------------- | --------------------------------------------------------- | | getThreatList | Gets global threat management list. Required: archived (bool). Optional: startTime/endTime (seconds since epoch), severity (0=Critical, 1=Major, 2=Moderate/Concerning, 3=Minor, 4=Low), page, pageSize. | | getTopThreats | Gets top threats from the global threat management view. |

Composite Troubleshooting Tools

Single-call tools that internally aggregate multiple Omada API calls in parallel. Use these instead of chaining individual tools when you need a quick overview or are starting a troubleshooting session.

| Tool | Description | | ---- | ----------- | | getNetworkHealthSummary | Composite: combines dashboard overview (device/client counts), internet/WAN status, client distribution, and recent active threats into a single response. First call for any troubleshooting session. | | getGatewayHealth | Composite: auto-discovers the gateway then fetches its detail (CPU, memory, firmware), WAN port statuses, LAN interface statuses, and port list in one call. Use for internet/WAN diagnostics. | | diagnoseClient | Composite: given a client MAC, IP, or hostname — fetches current connection status, detailed client info (VLAN, signal, policy), and recent connection history in one call. | | getSecurityOverview | Composite: combines active threat list (up to 20, newest first) and firewall settings into one response. Use for security posture checks or investigating alerts. |

Dashboard / Monitor

| Tool | Description | | ---------------------------- | --------------------------------------------------------------- | | getDashboardWifiSummary | Gets WiFi summary from the site dashboard. | | getDashboardSwitchSummary | Gets switch summary from the site dashboard. | | getDashboardTrafficActivities | Gets traffic activity data from the site dashboard. | | getDashboardPoEUsage | Gets PoE usage data from the site dashboard. | | getDashboardTopCpuUsage | Gets top CPU usage data from the site dashboard. | | getDashboardTopMemoryUsage | Gets top memory usage data from the site dashboard. | | getDashboardMostActiveSwitches | Gets most active switches from the site dashboard. | | getDashboardMostActiveEaps | Gets most active access points from the site dashboard. | | getDashboardOverview | Get the site overview: device counts, client counts, connectivity graph, and overall health status. | | getTrafficDistribution | Gets traffic distribution by protocol/app type over a time range. Requires start and end timestamps (seconds). | | getRetryAndDroppedRate | Gets wireless retry rate and dropped packet rate over a time range. Requires start and end timestamps (seconds). | | getIspLoad | Gets per-WAN ISP link load over a time range. Requires start and end timestamps (seconds). | | getChannels | Gets channel distribution and utilization across all APs. | | getInterference | Gets top RF interference sources detected by APs. | | getGridDashboardTunnelStats | Gets VPN tunnel statistics. Required: type (0 = Server, 1 = Client). | | getGridDashboardIpsecTunnelStats | Gets IPsec tunnel statistics. | | getGridDashboardOpenVpnTunnelStats | Gets OpenVPN tunnel statistics by type. Requires type parameter. |

Insight

| Tool | Description | | ------------------------- | ------------------------------------------------------------------ | | listSiteThreatManagement| Lists site-level threat management events. | | getWids | Gets WIDS (Wireless Intrusion Detection) information for a site. | | getRogueAps | Gets rogue access points detected in a site. | | getVpnTunnelStats | Gets VPN tunnel statistics for a site. |

VPN

| Tool | Description | | ----------------------------- | ---------------------------------------------------------------------------------------- | | getIpsecTunnelList | List all site-to-site VPN (IPsec) tunnels. Alias for listSiteToSiteVpns. | | getIpsecTunnelDetail | Get detailed config for a specific IPsec tunnel by ID. Alias for getSiteToSiteVpnInfo. | | getAdvancedVpnSetting | Get advanced VPN configuration settings for a site. Alias for getVpnSettings. | | getVpnUserList | Get VPN users for a site (paginated). | | getVpnUserDetail | Get users for a specific client-to-site VPN server. | | getVpnClientStatus | Get status of client-to-site VPN clients. Alias for listClientToSiteVpnClients. | | getVpnRouteConfig | [DEPRECATED] Use getGridPolicyRouting instead. This tool aggregates all pages; getGridPolicyRouting is paginated. |

Profiles

| Tool | Description | | ----------------------------- | ---------------------------------------------------------------------------------------- | | getGoogleLdapProfile | Get Google LDAP profile configuration for a site. | | getBuiltinRadiusUsers | Get built-in RADIUS server user list (paginated). | | getRadiusUserDetail | [DEPRECATED] Alias for getBuiltinRadiusUsers. | | getPpskNetworkProfile | List PPSK network profiles for a site by type. | | getPpskUserGroup | Get PPSK user group details for a specific profile. | | getPpskUserList | [DEPRECATED] Alias for getPpskUserGroup. | | getServiceProfile | Get service type profiles (paginated). Alias for listServiceType. | | getQosProfile | Get rate limit profiles. Alias for getRateLimitProfiles. | | getScheduleProfile | Get time range profiles. Alias for listTimeRangeProfiles. | | getGroupPolicyDetail | Get group policy profiles filtered by group type. | | getIpGroupProfile | [DEPRECATED] Get IP group profiles. Alias for getGroupPolicyDetail with groupType="0". | | getUrlGroupProfile | [DEPRECATED] Get URL/port group profiles. Alias for getGroupPolicyDetail with groupType="1". | | getAppGroupProfile | [DEPRECATED] Get MAC group profiles. Alias for getGroupPolicyDetail with groupType="2". | | getVlanProfile | Get LAN/VLAN profiles. Alias for getLanProfileList. | | getUserRoleProfile | Get user role profiles from the controller (global, no siteId). | | getPortalProfile | Get captive portal profiles for a site. |

Logs

| Tool | Description | | --------------------- | ------------------------------------------------------------ | | listSiteEvents | Lists site event logs. | | listSiteAlerts | Lists site alert logs. | | listSiteAuditLogs | Lists site audit logs. | | listGlobalEvents | Lists global event logs across all sites. | | listGlobalAlerts | Lists global alert logs across all sites. |

Controller

| Tool | Description | | ----------------------------- | ---------------------------------------------------------------------------------------- | | getCertificate | Get SSL/TLS certificate configuration for the controller. | | getClientHistoryDataEnable | Get the client history data collection enable setting. | | getControllerPort | Get the controller port configuration for device adoption. | | getDataRetention | Get data retention settings for the controller. | | getExperienceImprovement | Get the experience improvement program setting (telemetry). | | getGlobalDashboardOverview | Get global controller dashboard overview without client data. | | getPortalPort | Get portal port configuration for the controller web interface. |

Maintenance

| Tool | Description | | ----------------------------- | ---------------------------------------------------------------------------------------- | | getBackupFileList | List available controller backup files. | | getBackupResult | Get the result of the most recent controller backup operation. | | getRestoreResult | Get the result of the most recent controller restore operation. | | getSiteBackupFileList | List available backup files for a site. | | getSiteBackupResult | Get the backup result for a site. | | getRogueApExport | Export Rogue AP scan results for a site in CSV or Excel format. | | backupController | Trigger a controller configuration backup to the self/cloud server. | | backupControllerToFileServer | Trigger a controller configuration backup to an external file server (FTP/SFTP). | | restoreController | Restore controller configuration from a backup file on the self/cloud server. | | restoreControllerFromFileServer | Restore controller configuration from a backup file on an external file server. | | backupSites | Trigger a multi-site configuration backup to the self/cloud server (up to 300 sites). | | backupSitesToFileServer | Trigger a multi-site configuration backup to an external file server (up to 300 sites). | | restoreSites | Restore multiple site configurations from backup files on the self/cloud server. | | restoreSitesFromFileServer | Restore multiple site configurations from backup files on an external file server. |

Account Users

| Tool | Description | | ----------------------------- | ---------------------------------------------------------------------------------------- | | getAllCloudUsers | List all cloud users on the controller, excluding the root account. | | getAllLocalUsers | List all local users on the controller, excluding the root account. | | getAllRoles | [DEPRECATED] Use getUserRoleProfile instead. List all user roles configured on the controller. | | getAllUsersApp | List all users (cloud and local) in grid view. | | getAvailableRoles | List roles available for user assignment. | | getRoleDetail | Get detailed information about a specific role. Requires roleId. |

Account Cloud

| Tool | Description | | ----------------------------- | ---------------------------------------------------------------------------------------- | | getCloudAccessStatus | Get cloud access status for the controller. | | getCloudUserInfo | Get cloud user account information. | | getMfaStatus | Get global MFA (multi-factor authentication) status. | | getRemoteBindingStatus | Get remote binding status between controller and cloud. |

Schedules

| Tool | Description | | ----------------------------- | ---------------------------------------------------------------------------------------- | | getPoeScheduleList | List PoE schedules for a site. | | getPortScheduleList | List port schedules for a site. | | getPortSchedulePorts | List ports with port schedule assignments for a site. | | getRebootScheduleList | List device reboot schedules for a site template. Requires siteTemplateId. | | getUpgradeScheduleList | List firmware upgrade schedules for a site. |

Supported Omada API Operations

| Operation ID | Description | Tool | | ----------------------------------- | --------------------------------------------------------- | ----------------------------- | | getSiteList | List controller sites. | listSites | | getDeviceList | List devices assigned to a site. | listDevices, ~~getDevice~~ [DEPRECATED] | | searchGlobalDevice | Search for devices across all accessible sites. | searchDevices | | getGridAdoptedDevicesStatByGlobal | Query statistics for global adopted devices. | listDevicesStats | | getOswStackDetail | Retrieve details for a switch stack. | getSwitchStackDetail | | getSwitch | Get detailed info for a specific switch. | getSwitchDetail | | getGateway | Get detailed info for a specific gateway. | getGatewayDetail | | getGatewayWanPortStatus | Get WAN port status for a specific gateway. | getGatewayWanStatus | | getGatewayLanPortStatus | Get LAN port status for a specific gateway. | getGatewayLanStatus | | getGatewayPorts | Get port info for a specific gateway. | getGatewayPorts | | getAp | Get detailed info for a specific access point. | getApDetail | | getApRadios | Get radio info for a specific access point. | getApRadios | | getStackPorts | Get port info for a switch stack. | getStackPorts | | getGridPendingDevices | List devices pending adoption in a site. | listPendingDevices | | getGridActiveClients | List active clients connected to a site. | listClients, ~~getClient~~ [DEPRECATED] | | getMostActiveClients | Get most active clients sorted by traffic. | listMostActiveClients | | getClientActivity | Get client activity statistics over time. | listClientsActivity | | getGridPastConnections | Get client past connection history. | listClientsPastConnections | | updateClientRateLimitSetting | Set rate limit setting for a client. | setClientRateLimit, setClientRateLimitProfile, disableClientRateLimit | | getRateLimitProfileList | Get rate limit profile list. | getRateLimitProfiles | | getGlobalThreatList | Get global view threat management list. | getThreatList | | getTopThreatList | Get top threats from global threat management. | getTopThreats | | getInternet | [DEPRECATED] Use getInternetInfo instead. Get internet configuration info for a site. | getInternetInfo | | getPortForwardStatus | Get port forwarding status by type. | getPortForwardingStatus | | getLanProfileList | Get LAN profile list. | getLanProfileList | | getWlanGroupList | Get WLAN group list. | getWlanGroupList | | getSsidList | Get SSID list for a WLAN group. | getSsidList | | getSsidDetail | Get detailed SSID configuration. | getSsidDetail | | getSsidListAll | List SSIDs across all WLAN groups. | listAllSsids | | getFirewallSetting | Get the site-global firewall settings returned by the official Omada firewall endpoint. | getFirewallSetting | | modifyFirewallSetting | Update site firewall settings with dry-run support. | setFirewallSetting | | getVpn | Get VPN settings for a site. | getVpnSettings | | getSiteToSiteVpnList | List site-to-site VPN configurations. | listSiteToSiteVpns | | getPortForwardingList | List NAT port forwarding rules. | getPortForwardingList (prefer); ~~listPortForwardingRules~~ [DEPRECATED] | | getOsgAclList | List gateway ACL rules. | listOsgAcls | | getAclConfigTypeSetting | Get gateway ACL config mode for the site gateway. | getAclConfigTypeSetting | | modifyAclConfigTypeSetting | Update gateway ACL config mode with dry-run support. | setAclConfigTypeSetting | | createOsgAcl | Create a gateway ACL with dry-run support. | createGatewayAcl | | modifyOsgAcl | Update a gateway ACL with dry-run support. | updateGatewayAcl | | getEapAclList | List access point ACL rules. | listEapAcls | | createEapAcl | Create an EAP ACL with dry-run support. | createEapAcl | | modifyEapAcl | Update an EAP ACL with dry-run support. | updateEapAcl | | deleteAcl | Delete an ACL rule with dry-run support. | deleteAcl | | getStaticRoutingList | List static routing rules. | getGridStaticRouting (prefer); ~~listStaticRoutes~~ [DEPRECATED] | | getRadiusProfileList | List RADIUS authentication profiles. | listRadiusProfiles | | getGroupProfileList | List group profiles (IP, MAC, port groups). | listGroupProfiles | | getApplicationControlStatus | Get application control status for a site. | getApplicationControlStatus | | addRule | Create an application control rule with dry-run support. | setAppControlRule | | editRule | Update an application control rule with dry-run support. | setAppControlRule | | deleteRules | Delete an application control rule with dry-run support. | deleteAppControlRule | | getSshSetting | Get SSH settings for a site. | getSshSetting | | getTimeRangeProfileList | List time range profiles. | listTimeRangeProfiles | | getWanLanStatus | Get WAN-LAN connectivity status for a site. | getWanLanStatus | | getSiteThreatManagementList | List site-level threat management events. | listSiteThreatManagement | | getWids | Get WIDS information for a site. | getWids | | getRogueAps | Get rogue access points detected in a site. | getRogueAps | | getVpnTunnelStats | Get VPN tunnel statistics for a site. | getVpnTunnelStats | | getSiteEvents | List site event logs. | listSiteEvents | | getSiteAlerts | List site alert logs. | listSiteAlerts | | getSiteAuditLogs | List site audit logs. | listSiteAuditLogs | | getEvents | List global event logs across all sites. | listGlobalEvents | | getAlerts | List global alert logs across all sites. | listGlobalAlerts | | disableClientRateLimit | Disable rate limiting for a specific client, removing any bandwidth.... | disableClientRateLimit | | getAccessControl | Get controller access control configuration. | getAccessControl | | modifyAccessControl | Update portal access control configuration with dry-run support. | setAccessControl | | getAlg | Get ALG (Application Layer Gateway) configuration for the site gateway. | getAlg | | getAllDeviceBySite | Get all devices in a site including offline and disconnected devices. | getAllDeviceBySite | | getApDetail | Fetch full configuration and status for a specific access point: mo.... | getApDetail | | getApGeneralConfig | Get general configuration for an access point. | getApGeneralConfig | | getApLldpConfig | Get LLDP (Link Layer Discovery Protocol) configuration for an acces.... | getApLldpConfig | | getApRadios | Get radio status for a specific access point: 2.4GHz and 5GHz band .... | getApRadios | | getApSnmpConfig | Get SNMP configuration for an access point. | getApSnmpConfig | | getApUplinkConfig | Get the uplink configuration for an access point. | getApUplinkConfig | | getBandwidthControl | Get the global bandwidth control configuration for the site. | getBandwidthControl | | getCableTestLogs | Get cable test logs for a switch. | getCableTestLogs | | getChannels | Get channel distribution and utilization across all APs. | getChannels | | getClient | [DEPRECATED] Use listClients instead. When you have a client MAC, getClientDetail is also available. This tool filters the site client list in-process. | getClient | | getDashboardPoEUsage | Get PoE (Power over Ethernet) usage statistics for a site, showing .... | getDashboardPoEUsage | | getDashboardSwitchSummary | Get switch summary for a site dashboard: total switch count, total .... | getDashboardSwitchSummary | | getDashboardTopCpuUsage | Get the top devices by CPU usage for a site, useful for identifying.... | getDashboardTopCpuUsage | | getDashboardWifiSummary | Get WiFi summary for a site dashboard: total APs, connected AP coun.... | getDashboardWifiSummary | | getDdnsGrid | Get DDNS (Dynamic DNS) entries for the site gateway. | getDdnsGrid | | getDevice | [DEPRECATED] Use listDevices instead. This alias filters the device list in-process to return a single device; there is no separate device-detail API. | getDevice | | getDhcpReservationGrid | Get DHCP reservations for the site. | getDhcpReservationGrid | | createDhcpReservation | Create a DHCP reservation for the site after LAN/IP validation and duplicate-IP preflight. | createDhcpReservation | | updateSitesSettingServiceDhcp | Update an existing DHCP reservation for the site. | updateDhcpReservation | | deleteSitesSettingServiceDhcp | Delete an existing DHCP reservation for the site. | deleteDhcpReservation | | getDnsCacheSetting | Get DNS cache setting for the site gateway. | getDnsCacheSetting | | getDnsProxy | Get DNS proxy configuration for the site gateway. | getDnsProxy | | getFirewallSetting | Get the site-global firewall settings returned by the official Omada firewall endpoint. | getFirewallSetting | | modifyFirewallSetting | Update site firewall settings with dry-run support. | setFirewallSetting | | getFirmwareInfo | Get the latest available firmware information for a device. | getFirmwareInfo | | getGatewayDetail | Fetch full configuration and status for a specific gateway: model, .... | getGatewayDetail | | getGatewayLanStatus | Get LAN port status for a specific gateway: port link state, speed,.... | getGatewayLanStatus | | getGatewayPorts | Get all WAN and LAN port details for a specific gateway: link statu.... | getGatewayPorts | | getGatewayWanStatus | Get the WAN port status and connectivity information for a specific.... | getGatewayWanStatus | | getGridBandwidthCtrlRule | Get bandwidth control rules for the site gateway. | getGridBandwidthCtrlRule | | createBandwidthCtrlRule | Create a bandwidth control rule with dry-run support. | setBandwidthControlRule | | modifyBandwidthCtrlRule | Update a bandwidth control rule with dry-run support. | setBandwidthControlRule | | deleteBandwidthCtrlRule | Delete a bandwidth control rule with dry-run support. | deleteBandwidthControlRule | | getGridIpMacBinding | Get IP-MAC binding entries for the site. | getGridIpMacBinding | | getGridOtoNats | Get 1:1 NAT rules for the site gateway. | getGridOtoNats | | getGridPolicyRouting | Get policy routing rules for the site gateway. | getGridPolicyRouting | | getGridSessionLimitRule | Get per-rule session limit rules for the site gateway. | getGridSessionLimitRule | | getGridVirtualWan | Get virtual WAN list for the site gateway. | getGridVirtualWan | | getIgmp | Get IGMP (Internet Group Management Protocol) setting for the site. | getIgmp | | getInterfaceLanNetwork | Get interface-level LAN network bindings. | getInterfaceLanNetwork | | getInterference | Get top RF interference sources detected by APs. | getInterference | | getInternet | [DEPRECATED] Use getInternetInfo instead. Get full WAN/Internet configuration for the site gateway. | getInternet | | getInternetBasicPortInfo | Get WAN port summary / basic info for the site gateway. | getInternetBasicPortInfo | | getInternetInfo | Get internet configuration information for a site, including WAN se.... | getInternetInfo | | getInternetLoadBalance | Get WAN load balancing configuration for the site gateway. | getInternetLoadBalance | | getIspBandScan | Get ISP band scan results for a WAN port. Requires portUuid. | getIspBandScan | | getIspLoad | Get per-WAN ISP link load over a time range. | getIspLoad | | getLanClientCount | Get client distribution breakdown across LAN segments (wired, wireless, guest). | getLanClientCount | | getLanDnsRules | Get LAN DNS rules configured for the site (paginated). | getLanDnsRules | | getLanNetworkList | [DEPRECATED] Use getLanNetworkListV2 instead. This tool aggregates all pages; getLanNetworkListV2 is explicitly paginated. | getLanNetworkList | | getLanProfileEsUsage | Get EAP/switch device usage for a specific LAN profile. Requires profileId. | getLanProfileEsUsage | | getLanProfileList | Get the list of LAN profiles configured in a site. | getLanProfileList | | getLtePortConfig | Get LTE/cellular WAN port configuration for the site gateway. | getLtePortConfig | | getLldpSetting | Get LLDP (Link Layer Discovery Protocol) global setting for the site. | getLldpSetting | | getMeshStatistics | Get mesh link statistics for an access point. | getMeshStatistics | | getOswStackLagList | Get Link Aggregation Group (LAG) list for a switch stack. | getOswStackLagList | | getPortForwardingList | Get a paginated page of NAT port forwarding rules for the site gateway. | getPortForwardingListPage | | getPortForwardingStatus | Get port forwarding status and rules for a site. | getPortForwardingStatus | | getRFScanResult | [DEPRECATED] Get the last RF scan results for an access point. | getRFScanResult | | getRadiosConfig | Get per-radio configuration for an access point. | getRadiosConfig | | getRateLimitProfiles | Get the list of available rate limit profiles for a site. | getRateLimitProfiles | | getRemoteLoggingSetting | Get remote logging (syslog) configuration for the site. | getRemoteLoggingSetting | | getDnsCacheDataList | Get the DNS cache data list for the site (paginated). | getDnsCacheDataList | | getDisableNatList | Get the list of wired networks with NAT disabled (paginated). | getDisableNatList | | getIptvSetting | Get IPTV service configuration for the site. | getIptvSetting | | getNtpSetting | Get NTP server configuration and synchronisation status for the site. | getNtpSetting | | getOspfInterface | Get OSPF interface configuration for the site gateway. | getOspfInterface | | getOspfNeighbors | Get OSPF neighbor devices for the site gateway. | getOspfNeighbors | | getOspfProcess | Get OSPF process configuration for the site gateway. | getOspfProcess | | getSwitchVlanInterface | Get VLAN interface configuration for a specific switch. Requires switchMac. | getSwitchVlanInterface | | getSyslogConfig | [DEPRECATED] Alias of getRemoteLogging for controller syslog configuration. | getSyslogConfig | | getVrrpConfig | Get VRRP configuration for OSW devices on the site. | getVrrpConfig | | getWanHealthDetail | [DEPRECATED] Alias for the WAN health tool; kept for backward compatibility. Requires gatewayMac. | getWanHealthDetail | | getWanIspProfile | Get ISP scan profile result for a WAN port. Requires portUuid. | getWanIspProfile | | getWanNatConfig | Get one-to-one NAT configuration (WAN NAT rules) for the site gateway (paginated). | getWanNatConfig | | getWanPortDetail | [DEPRECATED] Use getWanPortsConfig instead. Get detailed WAN port configuration for all gateway WAN ports on the site. | getWanPortDetail | | getWanQosConfig | Get QoS configuration for gateway WAN ports on the site. | getWanQosConfig | | getWanUsageStats | [DEPRECATED] Use getDashboardTrafficActivities instead. Get WAN traffic usage statistics and activity data for the site. | getWanUsageStats | | getRetryAndDroppedRate | Get wireless retry rate and dropped packet rate over a time range. | getRetryAndDroppedRate | | getRogueAps | Get the list of rogue (unauthorized) access points detected by WIDS.... | getRogueAps | | getSessionLimit | Get the session limit global setting for the site gateway. | getSessionLimit | | getSnmpSetting | Get SNMP configuration for the site. | getSnmpSetting | | getSpeedTestResults | Get the last speed test results for an access point. | getSpeedTestResults | | getSitesApsChannelLimit | Get AP channel-limit configuration. | getSitesApsChannelLimit | | updateSitesApsChannelLimit | Update AP channel-limit configuration with dry-run support. | setApChannelLimit | | modifyGeneralConfig_2 | Update AP general configuration with dry-run support. | setApConfig | | modifyIpSettingConfig | Update AP IP settings with dry-run support. | setApConfig | | modifyIpv6SettingConfig | Update AP IPv6 settings with dry-run support. | setApConfig | | modifyApQosConfig | Update AP QoS settings with dry-run support. | setApConfig | | modifyRadiosConfig | Update AP radio settings with dry-run support. | setApConfig | | modifyApServicesConfig | Update AP service settings with dry-run support. | setApConfig | | modifyApLoadBalanceConfig | Update AP load-balance settings with dry-run support. | setApConfig | | modifyApOfdmaConfig | Update AP OFDMA settings with dry-run support. | setApConfig | | getSitesApsPowerSaving | Get AP power saving configuration. | getSitesApsPowerSaving | | updateSitesApsPowerSaving | Update AP power saving configuration with dry-run support. | setApPowerSaving | | modifyApTrunkSettingConfig | Update AP trunk settings with dry-run support. | setApConfig | | modifyApBridgeInfo | Update AP bridge settings with dry-run support. | setApConfig | | modifyApPort | Update AP port settings with dry-run support. | setApConfig | | modifyApChannelConfig | Update AP channel configuration with dry-run support. | setApConfig | | modifyAfcConfig | Update AP AFC configuration with dry-run support. | setApConfig | | modifyAntennaGainConfig | Update AP antenna gain settings with dry-run support. | setApConfig | | updateWlanGroupConfig | Update AP WLAN group assignment with dry-run support. | setApConfig | | modifyGeneralConfig_1 | Update gateway general configuration with dry-run support. | setGatewayConfig | | modifyConfigGeneral | Update gateway config/general settings with dry-run support. | setGatewayConfig | | modifyConfigServices | Update gateway services configuration with dry-run support. | setGatewayConfig | | modifyConfigAdvanced | Update gateway advanced settings with dry-run support. | setGatewayConfig | | modifyConfigRadios | Update gateway radio configuration with dry-run support. | setGatewayConfig | | modifyConfigWlans | Update gateway WLAN configuration with dry-run support. | setGatewayConfig | | modifyPortConfig | Update a gateway port configuration with dry-run support. | setGatewayConfig | | batchModifyPortConfig | Update multiple gateway ports with dry-run support. | setGatewayConfig | | getSshSetting | Get SSH access settings for a site. | getSshSetting | | getSsidDetail | Get detailed information for a specific SSID (wireless network), in.... | getSsidDetail | | getSsidList | Get the list of SSIDs (wireless networks) configured in a WLAN group. | getSsidList | | getStackNetworkList | Get the VLAN network list for a switch stack. | getStackNetworkList | | getStackPorts | Get all port information for a switch stack. | getStackPorts | | getSwitchDetail | Fetch full configuration and status for a specific switch: model, f.... | getSwitchDetail | | getSwitchStackDetail | Fetch detailed information for a specific switch stack. | getSwitchStackDetail | | getThreatList | Get the global view threat management list. | getThreatList | | getTopThreats | Get the top threats from the global threat management view across a.... | getTopThreats | | getTrafficDistribution | Get traffic distribution by protocol and application type over a ti.... | getTrafficDistribution | | getUpnpSetting | Get UPnP (Universal Plug and Play) setting for the site. | getUpnpSetting | | getVpnSettings | Get VPN configuration settings for a site. | getVpnSettings | | getVpnTunnelStats | Get VPN tunnel statistics for a site (paginated), including active .... | getVpnTunnelStats | | getWanLanStatus | Get the WAN and LAN connectivity status for a site. | getWanLanStatus | | getWanPortsConfig | Get WAN port settings for the site gateway. | getWanPortsConfig | | getWids | Get Wireless Intrusion Detection System (WIDS) information for a si.... | getWids | | getWlanGroupList | Get the list of WLAN groups configured in a site. | getWlanGroupList | | listAllSsids | List all wireless SSIDs across all WLAN groups in a site: SSID name.... | listAllSsids | | listClients | List all network clients (wired and wireless) connected to a site. | listClients | | listClientsActivity | Get client activity statistics over time from the dashboard. | listClientsActivity | | listClientsPastConnections | Get client past connection list with historical connection data. | listClientsPastConnections | | listDevices | List all provisioned (adopted) network devices in a site: gateways,.... | listDevices | | listEapAcls | List EAP (access point) ACL rules for a site: wireless client acces.... | listEapAcls | | listGlobalAlerts | List alert logs across all sites on the controller: threshold breac.... | listGlobalAlerts | | listGlobalEvents | List system event logs across all sites on the controller. | listGlobalEvents | | listGroupProfiles | List group profiles (IP groups, MAC groups, port groups) configured.... | listGroupProfiles | | listMostActiveClients | Get the most active clients in a site, sorted by total traffic. | listMostActiveClients | | listOsgAcls | List gateway (OSG) ACL rules for a site: firewall rules controlling.... | listOsgAcls | | listPendingDevices | List devices discovered on the network but not yet adopted into thi.... | listPendingDevices | | listPolicyRoutes | [DEPRECATED] Use getGridPolicyRouting instead. This tool aggregates all pages; getGridPolicyRouting is paginated. | listPolicyRoutes | | listPortForwardingRules | [DEPRECATED] Use getPortForwardingList instead. List all NAT port forwarding rules for a site: external port, inter.... | listPortForwardingRules | | listRadiusProfiles | List RADIUS authentication profiles configured for a site: server I.... | listRadiusProfiles | | listSiteAlerts | List alert logs for a site: threshold breaches, device failures, se.... | listSiteAlerts | | listSiteAuditLogs | List admin audit logs for a site: who made what configuration chang.... | listSiteAuditLogs | | listSiteEvents | List system event logs for a site: device online/offline, client co.... | listSiteEvents | | listSiteThreatManagement | List site-level threat management events detected by IPS, with opti.... | listSiteThreatManagement | | listSiteToSiteVpns | List site-to-site VPN configurations: tunnel name, remote IP, statu.... | listSiteToSiteVpns | | listSites | List all sites configured on the Omada controller. | listSites | | listStaticRoutes | [DEPRECATED] Use getGridStaticRouting instead. This tool aggregates all pages; getGridStaticRouting returns a single paginated page. | listStaticRoutes | | listSwitchNetworks | List VLAN network assignments for a switch. | listSwitchNetworks | | listTimeRangeProfiles | List time range profiles configured for a site. | listTimeRangeProfiles | | searchDevices | Search for devices globally across all sites the user has access to. | searchDevices | | setClientRateLimit | Set custom rate limit (bandwidth control) for a specific client. | setClientRateLimit | | getAclConfigTypeSetting | Get the ACL configuration type setting for the site gateway (L2 or .... | getAclConfigTypeSetting | | getAttackDefenseSetting | Get the DDoS and attack defense configuration, including flood prot.... | getAttackDefenseSetting | | getAuditLogSettingForGlobal | Get global audit log notification settings for the controller. | getAuditLogSettingForGlobal | | getAuditLogSettingForSite | Get site-level audit log notification settings, including audit eve.... | getAuditLogSettingForSite | | getAuditLogsForGlobal | Get global audit logs (paginated). | getAuditLogsForGlobal | | getBandSteeringSetting | Get the band steering configuration. | getBandSteeringSetting | | getBandwidthCtrl | [DEPRECATED] Use getBandwidthControl instead. Get the global bandwidth control configuration for the site. | getBandwidthControl | | getBeaconControlSetting | Get the beacon control setting, which manages 802.11 beacon transmi.... | getBeaconControlSetting | | getChannelLimitSetting | [DEPRECATED] Get the channel limit setting that restricts which cha.... | getChannelLimitSetting | | getClientActiveTimeout | Get the client inactivity timeout setting. | getClientActiveTimeout | | getClientDetail | Get full detail for a specific client by MAC address, including con.... | getClientDetail | | getClientToSiteVpnServerInfo | Get detailed configuration for a specific client-to-site VPN server.... | getClientToSiteVpnServerInfo | | getClientsDistribution | Get client count distribution by connection type and band (wired, 2.... | getClientsDistribution | | getControllerStatus | Get the Omada controller health and status, including running state.... | getControllerStatus | | getDeviceAccessManagement | Get the device access management settings, controlling which device.... | getDeviceAccessManagement | | getEapDot1xSetting | Get the 802.1X EAP setting for access points, controlling port-base.... | — | | getGeneralSettings | Get the global general settings for the Omada controller, including.... | getGeneralSettings | | getGridAllowList | Get the IPS allow list (paginated). | getGridAllowList